Privacy notice

Updated 9.9.2026

We process your personal data only in accordance with the General Data Protection Regulation and other applicable legislation.

The purpose of this Privacy Notice is to explain what personal data Huhtikuu Oy (“we”, “us” or “our”) processes about you, for what purposes and how such personal data is processed, and to inform you of your rights in relation to the personal data we process.

This Privacy Notice applies to you if you are our client, have applied for employment or a traineeship with us, or are one of our stakeholders.

1. Who is the controller?

Huhtikuu Oy (Business ID 3276000-4)
Hietalahdenranta 13 A 5
00180 Helsinki
Finland

Contact person for data protection matters

Joonas Karhu
Tel. +358 45 146 3700
hey@huhtikuu.fi

2. Whose personal data do we process?

This Privacy Notice applies to you if you belong to any of the following categories of data subjects:

a) you are our client or a representative, board member, owner or employee of our corporate client (the “Client”);

b) you have applied for employment or a traineeship with us (the “Applicant”); or

c) you are a person working in our industry, a student or another business partner (the “Stakeholder”).

Section 6 of this Privacy Notice explains separately for each category how we process your personal data.

3. How long do we retain personal data?

We process your personal data only for as long as necessary for the purposes of our operations and to comply with our legal obligations.

Retention periods vary depending on the purpose of processing. The retention periods applicable to you are set out in section 6 of this Privacy Notice under the relevant category of data subjects.

4. How do we protect your personal data?

Personal data in electronic form is protected by generally accepted and reasonable technical measures used in the industry, such as firewalls and passwords. Materials containing personal data that are not in electronic form are kept in locked premises to which unauthorised persons do not have access.

Access to the personal data we process is limited to members of our personnel and service providers acting on our instructions, in accordance with the access rights granted by us. We also require our service providers to take appropriate measures to protect the confidentiality and security of personal data.

We take into account applicable legislation, orders issued by competent authorities and industry guidelines concerning the confidential processing of personal data.

5. What are your rights in relation to the processing of your personal data?

You have the right to access the personal data concerning you that we hold. A request for access may be refused on grounds provided by law. Exercising this right is generally free of charge.

You have the right to request the rectification of inaccurate personal data concerning you. In certain circumstances, you also have the right to request the erasure of your personal data or the restriction of its processing on grounds provided by law.

You have the right to object to the processing of your personal data on grounds relating to your particular situation where we process your personal data on the basis of legitimate interests. If you wish to object to the processing of your personal data, you may contact us at hey@huhtikuu.fi. You must specify the particular situation on which your objection is based, unless otherwise stated below in relation to your category of data subjects.

Where you have provided personal data to us, and the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive such personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller.

If you have any questions regarding the processing of your personal data, please contact us at hey@huhtikuu.fi.

If you consider that we have not complied with applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

The competent supervisory authority in Finland is:

Office of the Data Protection Ombudsman
Lintulahdenkuja 4
00530 Helsinki
Finland
Tel. +358 29 566 6700
tietosuoja@om.fi

6. How do we process your personal data?

a) Clients

What personal data may we collect about you?

the Client’s name and/or the name of its representative, date of birth, personal identity code and other information necessary to identify the Client;
the Client’s contact details, including address, telephone number and email address;
information concerning the nature of the client relationship;
payment and invoicing information; and
other personal data obtained in connection with the client relationship and necessary for managing that relationship.

Depending on our client relationship, we may also process special categories of personal data, such as data concerning health and trade union membership.

We process such personal data only to the extent that:

the Client has given explicit consent to the processing of such data;
the processing relates to personal data which the Client has manifestly made public;
the processing is necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent; or
the processing is necessary for the establishment, exercise or defence of legal claims.

How do we collect your personal data?

As a rule, we collect your personal data directly from you.

We may also collect your personal data from credit information registers, registers of associations or the Trade Register, other public registers or other publicly available sources.

Why do we process your personal data and what is the legal basis for processing?

We process your personal data in order to establish and manage client relationships, for example to identify clients, communicate with clients by email and other means, and manage invoicing.

We may also process your personal data in order to develop and maintain our business and client relationships, for example by contacting you through a newsletter.

When we process the personal data of individual clients, the processing is based on the performance of a contract between the Client and us or on taking steps at the Client’s request prior to entering into a contract.

To the extent that the processing of personal data is not based on the performance of a contract, the processing is based on our legitimate interest in establishing and managing client relationships and carrying out client work.

The processing of your personal data is also based on our legitimate interest where we process your personal data for the purpose of developing and maintaining our business and client relationships, for example by contacting you through a newsletter.

Where we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such purposes.

To whom do we disclose your personal data?

We disclose your personal data to third parties only where this is necessary for managing the client relationship or complying with our legal obligations.

Where it is necessary for managing the client relationship to transfer your personal data outside the EU/EEA, we ensure that the transfer complies with the General Data Protection Regulation by relying on an adequacy decision of the European Commission or, where necessary, appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission, codes of conduct approved by a supervisory authority or certification mechanisms. In exceptional circumstances, personal data may also be transferred outside the EU/EEA in connection with an assignment in the specific situations provided for in Article 49 of the General Data Protection Regulation, for example where you have explicitly consented to the transfer.

We use external service providers that may process personal data on our behalf as part of the services they provide, such as providers of ICT, customer relationship management and electronic signature services, solely for the purposes specified in this Privacy Notice. In such circumstances, we have contractually ensured that the service providers process your personal data only in accordance with applicable data protection legislation and this Privacy Notice. Where these service providers transfer your personal data outside the EU/EEA, we ensure that the transfer complies with the General Data Protection Regulation by relying on an adequacy decision of the European Commission or, where necessary, appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission, codes of conduct approved by a supervisory authority or certification mechanisms.

How long do we retain your personal data?

We retain your personal data for as long as necessary to manage the client relationship, generally for two years after the client relationship has ended. Thereafter, we retain your personal data to the extent necessary to comply with our legal obligations.

b) Applicants

What personal data may we collect about you?

name, address, telephone number and email address;
your position in a company and the company’s contact details;
employment history, academic transcripts, educational background and other interests or information provided in your CV, employment certificates or during an interview;
age and date of birth;
language skills; and
other personal data provided by you.

You may decide what personal data you provide to us in connection with a recruitment process or when submitting an open application. If you do not provide certain personal data that we request, this may affect our ability to assess your suitability for the position adequately.

How do we collect your personal data?

We collect your personal data directly from you through your job application and during the interview process.

With your consent, we may also collect your personal data from referees identified by you.

Why do we process your personal data and what is the legal basis for processing?

We process your personal data in connection with a recruitment process or when you submit an open application to us in order to assess your suitability for the position.

Our processing is based on our legitimate interest in processing personal data in connection with recruitment or when assessing your open application. When processing your personal data on the basis of legitimate interests, we always take into account your right to privacy in relation to the legitimate interests described above.

In addition, if you are selected for the position, our processing may be based on taking steps at your request prior to entering into a contract.

To whom do we disclose your personal data?

As a rule, we do not disclose your personal data to third parties.

We use external service providers that may process personal data on our behalf as part of the services they provide, such as ICT service providers, solely for the purposes specified in this Privacy Notice. In such circumstances, we have contractually ensured that the service providers process your personal data only in accordance with applicable data protection legislation and this Privacy Notice. Where these service providers transfer your personal data outside the EU/EEA, we ensure that the transfer complies with the General Data Protection Regulation by relying on an adequacy decision of the European Commission or, where necessary, appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission, codes of conduct approved by a supervisory authority or certification mechanisms.

How long do we retain your personal data?

If you are not selected for the position, we retain your personal data for a maximum of two years after the recruitment process has ended or after you have submitted an open application.

If you are selected for the position, we will inform you separately about the processing of employees’ personal data and the applicable retention periods.

c) Stakeholders

What personal data may we collect about you?

First name, last name, position in a company and email address.

How do we collect your personal data?

We collect your personal data either directly from you or from publicly available sources, such as the website of the company you represent.

Why do we process your personal data and what is the legal basis for processing?

We process your personal data in order to develop our professional network and, for example, to invite you to events organised by us.

The processing is based on our legitimate interest in communicating about and marketing our events and developing our professional network for the purpose of developing and promoting our business. When processing your personal data on the basis of legitimate interests, we always take into account your right to privacy in relation to the legitimate interests described above.

You have the right to object to the processing of your personal data where we process your personal data on the basis of legitimate interests. You may contact us at hey@huhtikuu.fi if you wish to object to the processing of your personal data.

To whom do we disclose your personal data?

As a rule, we do not disclose your personal data to third parties.

How long do we retain your personal data?

Your personal data will be made inactive once two years have passed since your last contact with us. This means that we will retain your personal data but will no longer actively use it. Your personal data will be deleted within two years of being made inactive if you have not contacted us during that period.

7. Changes to this Privacy Notice

We may amend or update this Privacy Notice, for example, as a result of changes in legislation, case law or our own practices. The current version of this Privacy Notice is available on our website or may be reviewed at our premises.

8. Who can you contact about data protection matters?

If you have any questions concerning data protection, please contact us by email at hey@huhtikuu.fi.